Network Segmentation for Smart Home: VLANs and IoT

This post may contain affiliate links. As an Amazon Associate we earn from qualifying purchases. Disclosure.

Network segmentation is the practice of splitting your home network so cheap IoT devices can't reach your laptops, your files, or each other. It's the single biggest security upgrade most smart homes never make. I ran everything flat for years until a security scan showed me how chatty my devices were, all talking to servers I'd never heard of. Then I built a separate IoT VLAN, and the difference in peace of mind was real. Here's how to do it without breaking Home Assistant.

Bottom line: Put IoT devices on their own VLAN or guest network so a compromised gadget can't reach your computers. The catch is device discovery: Home Assistant finds devices over mDNS, which doesn't cross VLANs without an mDNS reflector and a few firewall rules. Plan those before you split the network.

This is the deep-dive companion to our Home Assistant hardening guide, which covers segmentation as one step among many. Here we go all the way.

Why Segment a Smart Home Network at All?

Segmentation contains a breach, so one hacked device stays trapped instead of becoming a foothold into your whole network. Budget smart plugs, bulbs, and cameras are notoriously under-secured, run outdated firmware, and phone home to servers you can't audit. On a flat network, any one of them sits beside your work laptop and your NAS.

Picture the worst case. A $12 camera with a hardcoded password gets compromised. On a flat network, the attacker can now scan and reach everything. On a segmented network, that camera can talk to Home Assistant and nothing else. Same breach, wildly different blast radius.

Is this paranoid for a few bulbs? A little. Is it sensible the moment you add cameras, locks, and a dozen no-name devices? Completely.

What Does a Segmented Smart Home Look Like?

The standard design uses three zones, each with its own rules about who can talk to whom. The firewall between them is where the security actually lives.

Trusted LAN: Your computers, phones, and NAS. Can reach the IoT network, but the IoT network can't reach it.
IoT VLAN: Smart plugs, bulbs, cameras, TVs. Isolated from the trusted LAN and ideally from each other.
Guest network: Visitors' devices, fully walled off from both of the above.

The key firewall rule is directional. Your trusted devices can initiate connections into the IoT network (so your phone app reaches a camera), but IoT devices cannot initiate connections back into the trusted LAN. That one rule does most of the work.

What Hardware Do You Need?

VLAN segmentation needs gear that understands VLANs, which rules out most basic ISP routers. You have a few tiers of options depending on budget and appetite.

Prosumer ecosystem: UniFi, Firewalla, or similar. The friendliest path, with VLANs and firewall rules in a clean interface.
Open-source router: OPNsense or pfSense on a small box. Maximum control, steeper learning curve.
VLAN-capable consumer router: Some higher-end consumer routers support VLANs and a real guest network.
Poor man's version: A plain guest network. Less flexible than a VLAN, but far better than a flat network and available on almost any router.

If you're not ready for managed switches, start with the guest-network approach today and graduate to VLANs later. The jump from flat to even basic isolation is the one that matters most.

How Do You Keep Home Assistant Working Across VLANs?

This is where segmentation trips people up: Home Assistant discovers most devices over mDNS, and mDNS does not cross VLAN boundaries on its own. Split your network naively and half your integrations stop auto-discovering. The fix is an mDNS reflector (Avahi reflector on OPNsense, or the mDNS repeater feature on UniFi) that forwards discovery traffic between the trusted and IoT VLANs.

Beyond mDNS, you'll open targeted firewall rules for the specific ports your devices need. A Chromecast needs certain ports, HomeKit needs others, and a Sonos system is famously picky. The pattern is the same: allow the trusted network and Home Assistant to reach the IoT VLAN on the needed ports, and reflect mDNS so discovery still works.

Where should Home Assistant itself live? Most people put it on the trusted LAN with a firewall rule allowing it to reach the IoT VLAN. Some put it directly on the IoT VLAN. Either works; the trusted-LAN placement is simpler to reason about. For the broader setup context, our Home Assistant setup guide covers where it fits.

A Practical Rollout Plan

Don't flip everything at once, because you'll spend a frustrating evening chasing what broke. Segment in stages and test as you go.

Stage 1: Create the IoT VLAN and the firewall rules, but leave devices where they are. Confirm the network itself is healthy.
Stage 2: Move a few non-critical devices (a couple of bulbs) to the IoT VLAN and confirm Home Assistant still controls them.
Stage 3: Set up the mDNS reflector and verify auto-discovery works across the boundary.
Stage 4: Migrate the rest in small batches, testing each integration as you go.

I migrated mine over a weekend in exactly these stages. The mDNS reflector was the one piece that, once configured, made everything click. Skip it and you'll think segmentation broke your setup when it's really just discovery.

Common Segmentation Mistakes to Avoid

Most segmentation headaches come from a handful of predictable mistakes, and knowing them up front saves an evening of debugging. I made several of these myself before the network settled.

Forgetting the mDNS reflector: This is the big one. Devices vanish from auto-discovery and people assume segmentation broke their setup. It didn't; mDNS just isn't crossing the VLAN. Set up the reflector before you migrate anything.
Over-isolating IoT-to-IoT: Some devices genuinely need to talk to each other. A Sonos system, for example, expects its speakers to see each other. Blanket client isolation on the IoT VLAN breaks them. Loosen it where a device family needs internal chatter.
Blocking outbound the device actually needs: A camera that uploads to a cloud app needs outbound internet. Cut it off entirely and the app breaks. Allow the outbound the device legitimately requires while still blocking lateral movement into your LAN.
Putting Home Assistant where it can't reach devices: If HA sits on the trusted LAN, it still needs a firewall rule permitting it into the IoT VLAN. Forget that and nothing responds.

The official Home Assistant networking documentation and your router vendor's mDNS guide are worth reading before you start, because the exact reflector setting differs between UniFi, OPNsense, and pfSense. The IoT device security weaknesses that make all this worthwhile are well documented by the OWASP IoT project, which catalogs the weak defaults and outdated firmware these cheap gadgets ship with.

A little planning here turns a frustrating migration into a smooth one. Get the reflector and firewall rules right first, and the device moves are almost boring.

Frequently Asked Questions

Does network segmentation break Home Assistant device discovery?

It can, because Home Assistant relies on mDNS, which doesn't cross VLANs by default. The fix is an mDNS reflector or repeater (built into UniFi, OPNsense, and pfSense) that forwards discovery traffic between your trusted and IoT VLANs. Configure it and auto-discovery works normally across the boundary.

Do I need a managed switch for segmentation?

For true VLANs, yes, you need VLAN-capable gear like a managed switch or a prosumer router. But you don't need to start there. A guest network on almost any router isolates IoT devices and is a major improvement over a flat network. Upgrade to VLANs when you're ready.

Which VLAN should Home Assistant live on?

Most people put Home Assistant on the trusted LAN with a firewall rule permitting it to reach the IoT VLAN. That keeps the dashboard easy to access while still controlling isolated devices. Placing it on the IoT VLAN also works but complicates reaching it from your computers. Trusted-LAN placement is the simpler default.

Is a guest network as good as a real VLAN?

Not quite, but it's close enough to matter. A guest network isolates IoT devices from your trusted devices, which is the main goal. It's less flexible than VLANs for inter-device rules and mDNS handling, but for most homes it delivers the bulk of the security benefit with none of the managed-switch cost.

Where to Start Today

If your network is flat right now, the highest-value move is the simplest: turn on your router's guest network and move your IoT devices onto it this afternoon. You'll get most of the breach-containment benefit immediately, with no new hardware. When you're ready to go further, plan the VLANs, set up the mDNS reflector first, and migrate in stages.

Segmentation is the security layer that works even when individual devices fail you, and cheap devices will fail you. It turns a single compromised gadget from a whole-network problem into a contained nuisance. Pair it with the rest of the checklist in our Home Assistant hardening guide, and choose the controller that anchors it all with our best smart home hub guide.